is the files/list_folder endpoint only available with token not with the key/secret pair?

The /2/files/list_folder endpoint only supports "user authentication", meaning it does require an access token. It does not support calling just using an app key/secret. 

 

It sounds like you're probably using an access token retrieved via the API Explorer though. The API Explorer has early access to an upcoming feature where an app can retrieve access tokens that are short-lived. If you use your own app to get an access token instead, e.g., via the OAuth flow, or just by clicking the "Generate" button on the app's info page on the App Console, that access token won't expire by itself, so you can store and re-use that long term instead.